‘If you don’t trust the network, just don’t use it.’
Photograph: John Macdougall/AFP/Getty Images

Airbnb and other home-sharing startups may be eating the hotel industry from the inside out, but as the number of people staying in strangers’ houses rises, so too does the security threat the whole industry poses.

When it comes to connecting to unknown networks, the typical Airbnb home network is likely to be less secure than a coffee shop Wi-Fi, hotel internet or even the extensive university network, according to security researcher Jeremy Galloway.

Speaking at the BlackHat conference in Las Vegas, Galloway argued that the threat posed by short-term rentals has always been high, but only in the last year has the sector grown to the extent that it should be considered one of the most important risks faced by those travelling.

“The media gets this wrong all the time,” Galloway said. “The biggest threats you face aren’t from some elite foreign government with zero days, it’s from simple threats.” While security researchers like focusing on esoteric attacks, Galloway argued that an Airbnb rental is far more likely to offer a successful method to steal credentials, infect machines and spy on browsing than most critical vulnerabilities.

Galloway’s own revelation came on a holiday to Colorado. “I snowboard like a Texan,” he said, “and I wanted to lift my spirits, so I thought: ‘I’ll head back to the rental, and hack the network to mess with my friends’ browsing,’

“Within five minutes flat, I owned the network.”

Among security professionals, open public Wi-Fi networks like those at coffee shops are common in attack scenario, because they are so easy to engineer into a “man in the middle” attack: an attacker can insert themselves into the connection, perhaps by pretending to be the coffee shop network themselves, and then intercept and modify traffic on the fly.

But the common features of short-term home rentals mean they’re probably even less secure than a typical coffee shop network, Galloway argues. The key problem is that the router at the heart of a home network is almost always physically accessible to everyone who stays: not only the (potentially malicious) homeowner, but also previous visitors.

That leaves the network open to what Galloway called the “average paperclip threat”: sticking a paperclip in the reset button of the router lets any attacker gain full admin rights over the router because they can reset the credentials and take control.

From there, they can attack future guests in a variety of ways. Adding a custom DNS server lets the attacker easily perform their own man-in-the-middle attacks, routing net traffic through their own computers even after they’ve left the house. Setting up a service to automatically copy over the log files from the router lets the attacker sit and wait until something valuable appears, even if it’s months later. Simply loading the backup file for the router itself can reveal most of the credentials it has stored, for further access to the network.

“To me, the router security situation is best illustrated by a raging dumpster file,” Galloway said.

For homeowners, he recommended simply locking away the router, either in a cupboard or a safe. “Lock the router up and it keeps it away from people that are curious … the point isn’t to create perfect security, the point is to raise the bar. Right now all an attacker needs to do to own a network is want to.”

For guests, connecting through a VPN-like TunnelBear can protect against man-in-the-middle attacks, as can simply not using a home Wi-Fi. Ultimately, Galloway concluded: “Be skeptical, be aware. If you don’t trust the network, just don’t use it.”